On Tuesday, Microsoft released a new patch bundle that
features three fixes for serious vulnerabilities of several Windows versions,
which could be taken advantage of by remote attackers.
Among the seven identified vulnerabilities, three were
considered to be "critical," three more were rated "important"
and only one was catalogued as "moderate."
The three critical ones were found in Microsoft's Internet
Explorer, DirectX and Bluetooth. The updates for the DirectX and Internet
Explorer are taking care of flaws affecting pretty much all existing versions
of Windows (including Windows 2000, XP and Vista).
The Bluetooth error can only be found with XP and Vista.
The general opinion is that the Bluetooth issue (addressed
by the MS08-030 patch) is the most serious one among the three critical
problems. This error could give remote attackers the chance to introduce malicious
code onto users’ computers; the only thing they would have to do is make use of
the Bluetooth technology on an open network.
"If you're running Bluetooth on your computer, that
means anybody else can hack your system and take control of it," Eric
Schultze, CTO of Shavlik Technologies, said. "You don't have to do
anything. Because you have Bluetooth turned on, someone can own your computer."
The other two critical vulnerabilities, affecting the Internet
Explorer, are addressed by the MS08-031 patch. Once a malicious website is
visited, because of the two errors, computers are left susceptible to remote
code execution.
Although there haven’t been any reports regarding the
exploitation of the aforementioned vulnerabilities, it is highly recommended
that all users install the update as soon as possible.